用于存储/检索PGP私钥和密码短语的安全方法

我有一个web应用程序，需要存储服务器登录信息。我使用2048bit PGP公钥来加密插入的密码（请参阅insertServerDef），使用带有密码短语的私钥来解密密码（请参见getServerDef）。

据我所知，这个链条中最薄弱的环节是私钥和密码短语的处理。正如您从下面的代码中看到的，我只是使用file_get_contents从当前web目录中的文件中检索密钥和密码短语，这并不好。

我的问题是：什么是安全检索私钥和密码短语以用于解密登录信息的好方法？也许我应该通过经过身份验证的远程文件服务器存储/检索私钥？

我一直在寻找最佳实践，但没能找到太多。

class DB {
    protected $_config;
    protected $_iUserId;
    protected $_iServerId;
    protected $_dbConn;
    protected $_sPubKey;
    protected $_sPrivKey;

    public function __construct($iUserId, $iServerId) {
        //bring the global config array into local scope
        global $config;
        $this->_config = $config;
        $this->_iUserId = $iUserId;
        $this->_iServerId = $iServerId;
        $this->_sPubKey = file_get_contents("public_key");
        $this->_sPrivKey = file_get_contents("private_key");
        $this->_sPrivKeyPass = trim(file_get_contents("private_key_pass"));
    }
    //connect to the database
    public function connect() {
        try {

            $this->_dbConn = new PDO("pgsql:host=".$this->_config['db_host']." dbname=".$this->_config['db_name'],$this->_config['db_username'],$this->_config['db_password']);
            echo "PDO connection object created";
        } catch(PDOException $e) {
            echo $e->getMessage();
        }
    }
    public function insertServerDef($sHost, $iPort, $sUser, $sPass) {
        //testing
        $iUserId = 1;
        $oStmt = $this->_dbConn->prepare("INSERT INTO upze_server_def (server_id, host_address, ssh_port, username, pass, user_id) VALUES (DEFAULT, :host_address, :ssh_port, :username, pgp_pub_encrypt(:pass,dearmor(:pub_key)), :user_id)");
        $oStmt->bindParam(':host_address',$sHost);
        $oStmt->bindParam(':ssh_port',$iPort);
        $oStmt->bindParam(':username',$sUser);
        $oStmt->bindParam(':pass',$sPass);
        $oStmt->bindParam(':pub_key',$this->_sPubKey);
        $oStmt->bindParam(':user_id',$iUserId);
        $oStmt->execute();
    }
    public function getServerDef($iServerId) {
        $oStmt = $this->_dbConn->prepare("  SELECT server_id, pgp_pub_decrypt(pass,dearmor(:priv_key),:priv_key_pass) As decryptpass 
                                            FROM upze_server_def usd 
                                            WHERE usd.server_id = :server_id
                                        ");
        $oStmt->bindParam(':server_id', $iServerId);
        $oStmt->bindParam(':priv_key', $this->_sPrivKey);
        $oStmt->bindParam(':priv_key_pass', $this->_sPrivKeyPass);
        $oStmt->execute();
        while($row = $oStmt->fetch()) {
            echo "<pre>".print_r($row)."</pre>";
        }
    }
    //close any existing db connection
    public function close() {
        $this->_dbConn = null;
    }

    //close any existing db connections on unload
    public function __destruct() {
        $this->_dbConn = null;
    }
}